1. Field of the Invention
The present invention relates to a technology used in a data server device and in particular, relates to a technology for coping with illegal accesses to a data server device.
2. Description of the Related Art
Recently, data servers connected to networks have often been illegally accessed. As a result, the system has often been taken over or data stored in the server have often been altered.
Conventionally, the manager of the server often first finds out about the illegal access when a user reports that something is awry, which may be long after the original break-in. As a result, illegal access can continue for a long time.
When a system is taken over or data are altered by such an illegal access, generally, the server is immediately severed from the network. However, in particular, when the authority of the manager of the server is taken over, for example, the communication cable physically connecting the server to the network must be disconnected. In order to cope with this problem, maintenance personnel must always be near the server hardware.
In order to cope with such a situation, it is also possible to remotely switch off the power source of a relay device, such as a router connecting the data server to the network. However, in this case, if the relay device is shared with other computer systems, they will also be affected.
When a data server has been taken over or a data of the server has been altered, it is useful to obtain the traces of the takeover or data alteration from the server in order to prevent similar illegal accesses from happening again. However, if such trace information is for example, left in the main memory of the taken-over server, it is difficult to read the trace information in main memory since the server has already been taken over. Specifically, since when the server is restarted, the trace information left in main memory is also lost, it is difficult to obtain the trace information in main memory.